CVE-2026-26245

8.8High

Published 15 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash

8.8High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-89

Impact

Authenticated remote users can execute arbitrary commands or code by abusing a SQL injection flaw. Attackers must already have a valid user account on the target system.

Root cause

Improper input sanitization leads to a SQL injection vulnerability within the Video Station application.

Affected systems

QNAP Video Station versions prior to 5.8.8.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade Video Station to version 5.8.8 or later via QTS App Center. If patching immediately is not possible, disable or stop the Video Station app and restrict network access to NAS user accounts.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later

References

https://www.qnap.com/en/app-release-notes?keyword=Video%20Station&app=VideoStationPro&product-line=nasRelease Notes

Source: nvd.nist.gov/vuln/detail/CVE-2026-26245